snuffleupagus/src/sp_cookie_encryption.c, branch 85beta2

Add support for PHP8.5

2025-09-01T11:44:31Z

Do not crash on no cookie hash key

2025-06-25T17:38:30Z

Do not dereference the hash key for cookie encryption if it's NULL: Program terminated with signal SIGSEGV, Segmentation fault. #0 zend_string_equal_content (s1=0x79bdb92170f0, s2=0x0) at /usr/include/php/20240924/Zend/zend_string.h:386 No locals. #1 zend_string_equals (s1=0x79bdb92170f0, s2=0x0) at /usr/include/php/20240924/Zend/zend_string.h:391 No locals. #2 sp_match_value (value=0x0, to_match=0x79bdb92170f0, rx=0x0) at ./src/sp_utils.c:273 No locals. #3 0x00007989377b0709 in sp_lookup_cookie_config (key=0x0) at ./src/sp_cookie_encryption.c:8 config = 0x79bdb92158d0 it = 0x79ae80dabd00 it = config = #4 decrypt_cookie (pDest=0x79893b6787c0, num_args=, args=, hash_key=0x7ffe657c3880) at ./src/sp_cookie_encryption.c:19 cookie = #5 0x000061875aac52df in zend_hash_apply_with_arguments () No symbol table info available. #6 0x00007989377ae74b in zm_activate_snuffleupagus (type=, module_number=) at ./src/snuffleupagus.c:228 config_wrapper = 0x7989377c3490 #7 0x000061875aa21710 in zend_activate_modules () No symbol table info available. #8 0x000061875a9a7f18 in php_request_startup () No symbol table info available.

Avoid dropping const qualifier in casts

2024-06-06T14:27:35Z

Adjusts casts to void dropping const qualifiers. This helps to avoid mistakes, e.g. modifying string literals. Also use size_t for length, similar to the upstream php interfaces.

config is stack allocated now + some code improvements (see details)

2021-09-23T10:23:40Z

* for easier memory manegement, the entire sp_config struct was merged into snuffleupagus_globals and allocated on stack where possible * SNUFFLEUPAGUS_G() can be written as SPG(), which is faster to type and easier to read * execution_depth is re-initialized to 0 for each request * function calls with inline string and length parameters consistently use ZEND_STRL instead of sizeof()-1 * execution is actually hooked if recursion protection is enabled * some line breaks were removed to make the code more readable

fixed incorrect debug log invocation

2021-08-06T14:40:57Z

fix snufflepagus_globals linking issues and one mac compatibility issue

2019-06-19T09:04:17Z

Fix the cookie's handling for PHP7.3+

2019-05-14T20:48:55Z

PHP 7.3+ added a new prototype for the cookie setting mechanism, breaking our ghetto samesite-injection, this commit takes care of it.

Try to unify the includes

2019-02-23T18:36:24Z

Bump a bit the coverage

2018-10-06T16:15:00Z

* `setcookie` doesn't always return `true` anymore * clang-format * Cookies with invalid decryption are dropped, but the request isn't anymore * faulty unserialize are now dumpable

Minor code cleanup

2018-08-30T15:14:08Z